AI Browser Agents: Handy but Risky for Privacy?

Imagine a digital assistant that browses the web for you: books flights, fills forms, compares prices. These are "browser agents," software using AI to automate navigation. Handy, right? But there's a catch.

Researchers put eight popular browser agents under the microscope. The verdict? Thirty-two privacy vulnerabilities. Some disable the browser's built-in protections; others "guess" and auto-fill sensitive data — addresses, card numbers, passwords — into form fields. It's like giving your house keys to a stranger who promises to do your grocery shopping.

The study built a framework with five check areas: vulnerable components, defense against website behaviors, cross-site tracking blocking, response to privacy-affecting prompts, personal data leaks to third parties. Fifteen measurements in total.

The good news? Researchers responsibly disclosed everything to developers and plan to release data and tools to help build safer agents. Meanwhile, if you use these tools, check what permissions you grant and what data you share. Convenience shouldn't cost your digital identity.

The paper (arXiv:2512.07725v1) introduces a systematic evaluation framework for LLM-based browser agents. The methodology covers five dimensions: (i) vulnerabilities in agent components (e.g., insecure configs, unverified extensions); (ii) protection against hostile website behaviors (fingerprinting, malicious scripts); (iii) cross-site tracking prevention via navigation context isolation; (iv) robustness to adversarial prompts attempting private data extraction; (v) data leakage to third parties during task execution.

Eight agents tested include open-source and commercial solutions. The 32 vulnerabilities range from missing security headers (CSP, HSTS) to plaintext credential storage, to "over-autocompletion" of sensitive fields based on prior conversational context. Particularly critical: agents injecting PII (Personally Identifiable Information) into third-party forms without explicit user consent.

Responsible disclosure followed coordinated timelines (90 days). The test dataset — prompts, responses, network traffic, screenshots — will be released under an open license for reproducible benchmarking. Future implications: standardization of "privacy profiles" for agents, mandatory sandboxing, audit trails of automated actions.